Ticket #22325: 22325.diff

wp-includes/class-wp.php

@@ -84 +84 @@
         var $did_permalink = false;
 
         /**
+         * Unslashed GET superglobal
+         *
+         * @since 3.6.0
+         * @var array
+         */
+        var $GET = array();
+
+        /**
+         * Unslashed POST superglobal
+         *
+         * @since 3.6.0
+         * @var array
+         */
+        var $POST = array();
+
+        /**
+         * Unslashed REQUEST superglobal
+         *
+         * @since 3.6.0
+         * @var array
+         */
+        var $REQUEST = array();
+
+        /**
          * Add name to list of public query variables.
          *
          * @since 2.1.0

wp-includes/load.php

@@ -530 +530 @@
  * @since 3.0.0
  */
 function wp_magic_quotes() {
+        global $wp;
+
         // If already slashed, strip.
         if ( get_magic_quotes_gpc() ) {
                 $_GET    = stripslashes_deep( $_GET    );
@@ -537 +539 @@
                 $_COOKIE = stripslashes_deep( $_COOKIE );
         }
 
+        // During setup, we don't have a global request object
+        if ( isset( $wp ) ) {
+                // Store the unslashed superglobals
+                $wp->GET     = $_GET;
+                $wp->POST    = $_POST;
+                $wp->REQUEST = array_merge( $_GET, $_POST );
+        }
+
         // Escape with wpdb.
         $_GET    = add_magic_quotes( $_GET    );
         $_POST   = add_magic_quotes( $_POST   );

wp-settings.php

@@ -213 +213 @@
 // Define constants which affect functionality if not already defined.
 wp_functionality_constants();
 
-// Add magic quotes and set up $_REQUEST ( $_GET + $_POST )
-wp_magic_quotes();
-
 do_action( 'sanitize_comment_cookies' );
 
 /**
@@ -247 +244 @@
  */
 $wp = new WP();
 
+// Add magic quotes and set up $_REQUEST ( $_GET + $_POST )
+wp_magic_quotes();
+
 /**
  * WordPress Widget Factory Object
  * @global object $wp_widget_factory